5 ms·
That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them
by pwdisswordfishy 7mo ago
That's just a tautology.
"If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated".
The above is a true statement for all X.
- deleted 7mo ago[deleted]
- nightpool 7mo ago? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed. Unfortunately, it doesn't look like Algolia has implemented this
- TurdF3rguson 7mo agoI'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.
- deleted 7mo ago[deleted]
- richbell 7mo agoIf you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.
- TurdF3rguson 7mo agoOk I see, so any public gist with an algolia key in it will get invalidated? And it would have to follow some pattern like ALGOLIA_KEY=xxx ?
- nightpool 7mo agoit works for any gist, public or private. it doesn't need to follow a certain format. it's just based on how the secret itself is formatted—it works for secrets that have a predictable pattern, like the AWSK prefix for Amazon keys. if algolia keys have this predictable pattern, then they can enroll in secret scanning. If they don't then they probably can't
- wat10000 7mo agoEnglish is not formal logic. In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store. In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.
- pwdisswordfishy 7mo agoYes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted for sale on Craiglist (<https://www.youtube.com/watch?v=xWG3jKzKcm8 https://www.youtube.com/watch?v=xWG3jKzKcm8>).
- richbell 7mo agoHow is reminding people that they can safely revoke exposed API keys not informative? Why are you being so combative?
- pwdisswordfishy 7mo agoBecause "This has to be one of the dumbest, most reckless threads to have been posted (and so vociferously defended) on HN." https://news.ycombinator.com/item?id=47419913 https://news.ycombinator.com/item?id=47419913
- wat10000 7mo agoIt's more useful than telling someone that their statement is a tautology in formal logic.
- pwdisswordfishy 7mo agoNo it's not.